Analysis
- max time kernel
149s - max time network
142s - platform
windows11-21h2_x64 - resource
win11-20251211-en - resource tags
- submitted
15/12/2025, 14:06
General
- Target msedge_elf.dll
- Size 9.2MB
- Sample251215-rel83sdr3y
- SHA256 09d93e6c5cbbd1cc74ed0acd279e7350d32f7aff2d7050a9bd4d5616770d4146
Score
10/10
Malware Config
Extracted
Family
-
vidar
Botnet
-
f8b862043c72a2fb55c1db945ec59b23
Campaign
-
cego54
C2
-
https://telegram.me/cego54
Signatures
- Detects Vidar Stealer 2 IoCs
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Vidar family
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\msedge_elf.dll,#11⤵
- Badlisted process makes network request
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4816-0-0x0000000140000000-0x0000000140189000-memory.dmp
memory/4816-1-0x0000000140000000-0x0000000140189000-memory.dmp
memory/4816-14-0x0000000140000000-0x0000000140189000-memory.dmp
memory/4816-13-0x00007FF824670000-0x00007FF824E49000-memory.dmp
memory/4816-20-0x00007FF824670000-0x00007FF824E49000-memory.dmp
memory/4816-26-0x00007FF824670000-0x00007FF824E49000-memory.dmp